Embedded Files
ETHICAL HACKER
ACTIVE DIRECTORY:
Enterprise Adoption and Market Share
ACTIVE DIRECTORY:
Enterprise Adoption and Market Share
Active Directory (AD) dominates the global enterprise market, being utilized by approximately 90% of Fortune 1000 companies and major corporations worldwide.
Active Directory (AD) dominates the global enterprise market, being utilized by approximately 90% of Fortune 1000 companies and major corporations worldwide.
It stands as the absolute standard for on-premises identity management, integrating natively into any IT infrastructure based on Windows Server.
It stands as the absolute standard for on-premises identity management, integrating natively into any IT infrastructure based on Windows Server.
Despite the aggressive growth of cloud services, it is not being abandoned; enterprises rely on a hybrid approach combining AD with Microsoft Entra ID (formerly Azure AD) to bridge local and cloud security
Despite the aggressive growth of cloud services, it is not being abandoned; enterprises rely on a hybrid approach combining AD with Microsoft Entra ID (formerly Azure AD) to bridge local and cloud security
1. OSINT: identify the target
1. OSINT: identify the target
verify email:
https://tools.emailhippo.com/
- account recovery on alice.it
https://dehashed.com/
SEARCH: through billions of records, including names, email addresses, usernames, IP addresses, physical addresses, phone numbers, vehicle identification numbers, and web domains.
verify email:
https://tools.emailhippo.com/
- account recovery on alice.it
https://dehashed.com/
SEARCH: through billions of records, including names, email addresses, usernames, IP addresses, physical addresses, phone numbers, vehicle identification numbers, and web domains.
WHOIS: The newly-launched WHOIS database allows users to search through web domain registration information, including historical data.
WHOIS: The newly-launched WHOIS database allows users to search through web domain registration information, including historical data.
ASSETFINDER:
https://github.com/tomnomnom/assetfinder
https://github.com/owasp-amass/amass
https://github.com/tomnomnom/httprobe - verify if domain hunted is alive
ASSETFINDER:
https://github.com/tomnomnom/assetfinder
https://github.com/owasp-amass/amass
https://github.com/tomnomnom/httprobe - verify if domain hunted is alive
- sort only https
- sort only https
most powerful tools for subdomains hunting:
most powerful tools for subdomains hunting:
- see image below
- see image below
Find website's info - cms etc
whatweb
wappalizer
https://www.kali.org/tools/burpsuite/
GOOGLE FU:
- site:website.com -www -ir (different subdomains)
- site:website.com filetype:pdf -csv -
linkedin premium + socials
SCREENSHOT WEBSITE WITH GOWITNESS
https://github.com/sensepost/gowitness
The main goal of gowitness is to take website screenshots (and do that well!), while optionally saving any information it gathered along the way.
Find website's info - cms etc
whatweb
wappalizer
https://www.kali.org/tools/burpsuite/
GOOGLE FU:
- site:website.com -www -ir (different subdomains)
- site:website.com filetype:pdf -csv -
linkedin premium + socials
SCREENSHOT WEBSITE WITH GOWITNESS
https://github.com/sensepost/gowitness
The main goal of gowitness is to take website screenshots (and do that well!), while optionally saving any information it gathered along the way.
FIND VULNERABILITIES:
https://github.com/heltonWernik/OpenLuck
rapid7: http://rapid7.com/db/
KALI searchsploit Samba 2.2.1a / mod ssl 2
FIND VULNERABILITIES:
https://github.com/heltonWernik/OpenLuck
rapid7: http://rapid7.com/db/
KALI searchsploit Samba 2.2.1a / mod ssl 2
Or, a better way:
Compromise DC without passwords or other things...
Or, a better way:
Compromise DC without passwords or other things...
mimikatz # sekurlsa::logonPasswords
mimikatz # sekurlsa::logonPasswords
Page updated
Google Sites
Report abuse